Security experts have identified a sophisticated cyber espionage campaign in which Russian-linked hacker groups have compromised hotel Wi-Fi networks across multiple countries, including the United States, India, and Saudi Arabia. The attackers targeted public Wi-Fi in hotels, conference centers, and other venues frequented by travelers, using hijacked login portals to infect devices with spyware and redirect users to fraudulent websites.

Microsoft attributed the operation, dubbed “CaptiveCrunch,” to Cozy Bear, a hacking group linked to Russia’s foreign intelligence service. Meanwhile, cybersecurity firm ReliaQuest noted similarities to tactics employed by Fancy Bear, another Russian group associated with military intelligence. Both groups are known for conducting cyber espionage targeting governments and organizations.

The intrusion involved manipulating the Wi-Fi sign-in pages that users typically encounter when connecting to hotel networks. Once redirected to fake login portals, users were prompted with pop-up notifications urging them to perform a supposed “manual update” of their web browsers. Accepting this prompt led to the installation of malware designed to harvest login credentials, activate device cameras and microphones, and extract authentication tokens. These tokens provided the hackers with persistent access to compromised networks without requiring repeated login codes.

The campaign’s reach across different regions underscores the global scope of cyber threats targeting travelers who rely on unsecured or semi-secured public wireless networks. Security professionals have urged travelers to exercise caution when connecting to unfamiliar Wi-Fi networks, recommending the use of virtual private networks (VPNs) or mobile hotspots to safeguard sensitive information.

The cyberattack highlights ongoing concerns about the vulnerability of public internet access points to state-sponsored hacking groups seeking intelligence or operational advantages by infiltrating devices and networks through widely used communication infrastructure.